# CPalius CMF 2.2.21

**Released:** 2026-09-25 · **Channel:** stable · **Critical:** no

Turkish: [2.2.21-tr.md](2.2.21-tr.md)

Two changes: Security Center now shows what's actually attacking the site, not just configuration advice, and page-view counting moved out of core into an optional module.

## Security Center shows live threats, not just posture advice

The Security Center page was an audit checklist (2FA off, CSP report-only, that kind of recommendation) plus a bare IP-ban form. The live threat data — the individual request that tripped the WAF, its IP, its payload, which attack vectors are active, which IPs keep coming back — already existed, collected the whole time by the request scanner, but was only ever shown on the general AACP dashboard's shared telemetry widget. It's now on Security Center itself: a live threat feed, a vector breakdown, and a top-offenders list, shown whenever the scanner is on, with a clear prompt to turn it on when it's off.

## Page-view counting is now the VisitorStats module, not core

Telemetry (security event logging) stays in core — every internet-facing install needs basic threat detection regardless of what it's for. Counting page views doesn't: a CPalius core repurposed as a headless CRM or ERP backend has no public site to count visits on. That code is now the VisitorStats module. Core depends only on two small interfaces; deactivating the module simply stops counting page views, at zero cost, with nothing else affected.

The module also has its own page now, with real daily history — the old dashboard widget only ever showed today's totals and a 24-hour chart, even though the underlying daily counters have been kept indefinitely since 2.2.20. There was just nowhere to see that history before.

Every site already running 2.2.20 was counting page views as core behavior; this update activates the new module automatically during the upgrade so that continues exactly as before. A brand new install is unaffected either way.

## Upgrade notes

No schema changes beyond what 2.2.20 already added. The VisitorStats module is activated automatically on upgrade; no manual action needed.